Login Request a demo
SV
Product
svelte
by sveltejs · last CVE Jun 9, 2026
10
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 0High 1Medium 9Low 0
Severity
All severities10Critical0High1Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add svelte to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-42567
7.5
0%
Jun 9
Svelte: ReDoS in `<svelte:element>` Tag Validation
Affected: >= 5.51.5, < 5.55.7
CVE-2026-27125
6.8
0%
Feb 20
Svelte SSR attribute spreading includes inherited properties from prototype chain
Affected: < 5.51.5
CVE-2026-42599
6.1
0%
Jun 9
Cross-site scripting via spread attributes in Svelte SSR
Affected: < 5.55.7
CVE-2026-42573
6.1
0%
Jun 9
Svelte: XSS via DOM Clobbering of Internal Framework State
Affected: < 5.55.7
CVE-2026-27901
6.1
0%
Feb 26
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Affected: < 5.53.5
CVE-2024-45047
6.1
0%
Aug 30
Potential mXSS vulnerability due to improper HTML escaping in svelte
Affected: < 4.2.19
CVE-2026-27902
5.4
0%
Feb 26
Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
Affected: >= 5.53.0, < 5.53.5
CVE-2026-27122
5.4
0%
Feb 20
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
Affected: < 5.51.5
CVE-2026-27121
5.4
0%
Feb 20
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Affected: < 5.51.5
CVE-2026-27119
5.4
0%
Feb 20
Svelte affected by XSS in SSR `<option>` element
Affected: >= 5.39.3, < 5.51.5
Showing 10